# 3-D Secure 2: the friction that costs less than the chargeback | BondProof

Source: https://bondproof.com/blog/2026-11-13-3ds2-friction-chargeback-tradeoff.html

[Home](../index.md) / [Blog](index.md)


November 13, 2026 - BondProof

**Short answer:** 3-D Secure 2 asks the cardholder to prove it is really them, but only when the transaction looks risky. Low-risk payments pass without a challenge, and the merchant gets a liability shift: if an authenticated payment turns out to be fraud, the issuer eats it, not the merchant. The friction is targeted, and the chargeback it prevents costs far more than the sale it delays.

## What actually changed with version 2

The old 3-D Secure was a redirect to a bank page that looked like a phishing site and behaved like one too. Customers abandoned carts, banks ran clunky password systems, and merchants turned the whole thing off. Version 2 rebuilt it: the check happens inside the checkout, the issuer sees device and behaviour data instead of just a password, and most transactions pass with no challenge at all. The friction moved from every payment to the risky ones.

The decision is risk-based. The issuer receives data points about the transaction, the device, the purchase history, and the merchant, and decides whether to approve silently or challenge. A regular customer buying a familiar product on a known device sails through. A new device, a new address, a high-value order at 3 a.m. gets the challenge. That split is the whole point of version 2, and it is why the conversion cost is much smaller than merchants remember from version 1.

For merchants in Europe, Strong Customer Authentication under PSD2 made this mandatory for most online card payments. The regulation does not care whether the merchant likes the friction. It cares whether the payment is authenticated, and it gives exemptions for low-value and low-risk transactions precisely so the friction lands where the risk is.

## The liability shift is the part merchants underprice

When a payment goes through 3-D Secure and is authenticated, liability for fraud chargebacks shifts from the merchant to the issuer. If the cardholder later claims the payment was fraudulent, the issuer bears the loss, because the issuer authenticated it. That is a real transfer of risk, not a marketing claim, and it applies to the transactions that need it most: the ones risky enough to challenge.

Compare that with the alternative. An unauthenticated payment that turns out to be fraud lands on the merchant as a chargeback, plus a dispute fee, plus a hit to the dispute ratio that the card networks watch. Visa's excessive-merchant threshold for disputes sits at 150 basis points in the US, Canada, EU, AP, and LAC as of April 2026. A merchant running hot on disputes pays for it in monitoring, fines, and eventually the account.

The arithmetic is simple once you write it down. A challenge costs you the small share of legitimate customers who abandon at the challenge step. An unauthenticated fraud costs you the full order value, the dispute fee, and a step toward a monitoring program. Merchants who refuse 3-D Secure to protect conversion are protecting the wrong number.

## Where to put it, and where not to

Apply 3-D Secure to risky payments, not to all of them. The tools exist to do this precisely: Stripe Radar and similar systems let you trigger 3-D Secure when the risk score crosses a threshold, when the device is new, or when the order value is high. Blanket 3-D Secure on every transaction is the version 1 mistake repeated with better technology.

The challenge itself should be the issuer's native flow, not a redirect to a page that looks nothing like your store. The version 2 flow keeps the customer in context, which is why abandonment is far lower than the old redirect. If your provider still redirects to a bank page that looks like 2012, the provider is the problem, not the protocol.

And measure it honestly. Track the challenge rate, the authentication success rate, and the abandonment rate on challenged payments separately from your overall conversion. A merchant who only watches blended conversion will conclude that 3-D Secure hurts, because the challenged segment is the risky segment. The question is not whether challenged payments convert worse. It is whether the fraud they stop costs more than the sales they lose.

Keep reading: [Why do bots attack the password reset page instead of the login page?](https://bondproof.com/blog/2026-11-12-password-reset-abuse-bots.md), [How do bots turn stolen cards into gift cards?](https://bondproof.com/blog/2026-11-12-stolen-cards-gift-card-cashout.md), and [How do bots exploit buy-online-pickup-in-store to move stolen cards?](https://bondproof.com/blog/2026-11-11-bopis-pickup-fraud-bots.md) cover the nearby cases in this series.

## Frequently asked questions

### What is 3-D Secure 2?

3-D Secure 2 is the current version of the card authentication protocol that asks the cardholder to prove their identity during an online payment. Unlike the first version, it uses risk data to decide which payments need a challenge, so most legitimate payments pass with no extra step.

### Does 3-D Secure shift liability for fraud to the issuer?

Yes, for authenticated transactions. When a payment is authenticated through 3-D Secure and later turns out to be fraud, the issuer bears the loss instead of the merchant. That liability shift is the main financial reason to use it on risky payments.

### Will 3-D Secure hurt my conversion rate?

It will cost some challenged payments, but the effect is far smaller than the old version because most low-risk payments pass with no challenge. The right comparison is not challenged versus unchallenged conversion. It is the sales lost to challenges against the chargebacks and dispute fees the challenges prevent.

### When should I trigger 3-D Secure?

On payments that look risky: new devices, new addresses, high order values, unusual times, or a risk score above your threshold. Applying it to every transaction wastes the benefit. Applying it to none leaves the fraud bill with you.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)